[
https://issues.apache.org/jira/browse/ARTEMIS-2886?focusedWorklogId=493877&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-493877
]
ASF GitHub Bot logged work on ARTEMIS-2886:
-------------------------------------------
Author: ASF GitHub Bot
Created on: 02/Oct/20 09:39
Start Date: 02/Oct/20 09:39
Worklog Time Spent: 10m
Work Description: luisalves00 edited a comment on pull request #3254:
URL: https://github.com/apache/activemq-artemis/pull/3254#issuecomment-702623828
`if (bareQueue != null) {
fqqn = CompositeAddress.toFullyQualified(bareAddress, bareQueue);
if (securityRepository.containsExactMatch(fqqn.toString())) {
roles = securityRepository.getMatch(fqqn.toString());
isFullyQualified = true;
}
}`
I think this runs against:
`<security-settings>
<security-setting match="#">
<permission type="createNonDurableQueue" roles="amq"/>
<permission type="deleteNonDurableQueue" roles="amq"/>
<permission type="createDurableQueue" roles="amq"/>
<permission type="deleteDurableQueue" roles="amq"/>
<permission type="createAddress" roles="amq"/>
<permission type="deleteAddress" roles="amq"/>
<permission type="consume" roles="amq"/>
<permission type="browse" roles="amq"/>
<permission type="send" roles="amq"/>
<!-- we need this otherwise ./artemis data imp wouldn't work -->
<permission type="manage" roles="amq"/>
</security-setting>
</security-settings>`
Not 100% sure. But since I have # this will never be an exact match and
therefore I don't receive the **fqqn** in the ActiveMQSecurityManager5
implementation. Is it possible to change this behavior? I really need to get
the fqqn and I don't know it beforehand. Clients will create their addresses
(following an convention), but they are dynamic so I cannot list them on the
XML.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
Issue Time Tracking
-------------------
Worklog Id: (was: 493877)
Time Spent: 3h (was: 2h 50m)
> Optimize security auth
> ----------------------
>
> Key: ARTEMIS-2886
> URL: https://issues.apache.org/jira/browse/ARTEMIS-2886
> Project: ActiveMQ Artemis
> Issue Type: Improvement
> Reporter: Justin Bertram
> Assignee: Justin Bertram
> Priority: Major
> Fix For: 2.16.0
>
> Time Spent: 3h
> Remaining Estimate: 0h
>
> Both authentication and authorization will hit the underlying security
> repository (e.g. files, LDAP, etc.). For example, creating a JMS connection
> and a consumer will result in 2 hits with the *same* authentication request.
> This can cause unwanted (and unnecessary) resource utilization, especially in
> the case of networked configuration like LDAP.
> There is a rudimentary cache for authorization, but it is cleared *totally*
> every 10 seconds by default (controlled via the
> {{security-invalidation-interval setting}}), and it must be populated
> initially which still results in duplicate auth requests.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
